Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cd95f7fbae1c67c…

MALICIOUS

PDF

86.7 KB Created: 2021-03-16 06:33:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5fdfb916225095c874ceae5ff6e758cb SHA-1: 53a47df78beb172d1ba2d17592eb2e30f0503c4c SHA-256: 1cd95f7fbae1c67c0c5e81a3422e9fc1b1579e71177932bf06a6c2e0fed007be
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm designed to redirect users. One prominent URL, 'https://nipisod.ru/wix?keyword=super+juice+me+28-day+juice+plan+book+pdf', is directly embedded and likely leads to a malicious site. ClamAV also detected this file as Pdf.Phishing.Trojan, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=super+juice+me+28-day+juice+plan+book+pdf
    • https://mafetoga.weebly.com/uploads/1/3/0/8/130874134/rumiga-lalupif.pdf
    • https://cdn-cms.f-static.net/uploads/4419628/normal_6037382158727.pdf
    • https://static.s123-cdn-static.com/uploads/4451551/normal_5ff7bbb6bbd81.pdf
    • https://static.s123-cdn-static.com/uploads/4501198/normal_5fce706a27d85.pdf
    • https://rebolaje.weebly.com/uploads/1/3/4/6/134696551/5774323.pdf
    • https://static.s123-cdn-static.com/uploads/4393521/normal_5fdf67ca37523.pdf
    • https://static.s123-cdn-static.com/uploads/4489975/normal_5fee2cdbb8717.pdf
    • http://ruboperuba.iblogger.org/nazikiwofuji.pdf
    • https://cdn-cms.f-static.net/uploads/4420260/normal_5fdc32bb4a298.pdf
    • https://wisemidotoveto.weebly.com/uploads/1/3/4/3/134349295/nojoxupekuxugalewame.pdf
    • https://ranitezal.weebly.com/uploads/1/3/1/4/131438109/7299199.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ec4f961c-f787-40d8-aea5-cdd4be093abb/jikewilizejogewav.pdf
    • https://uploads.strikinglycdn.com/files/7f5305a2-6aa1-427d-a121-876b1ddd050e/piwozikisiviwej.pdf
    • https://uploads.strikinglycdn.com/files/b55277ea-4a3b-4de0-a628-c7cff27266cf/hunter_irrigation_controller_not_working.pdf
    • http://kiwozoma.epizy.com/32611173441.pdf
    • https://uploads.strikinglycdn.com/files/cd47aa54-b9bf-4c3e-b717-cdf5a92e5471/dsc_add_user_codes.pdf
    • http://xovanesoku.epizy.com/71241377867.pdf
    • https://uploads.strikinglycdn.com/files/12d4ad15-a5af-4554-a681-d6324a34fc3e/wowad.pdf
    • http://bekepijamewevo.epizy.com/8295824466.pdf
    • https://uploads.strikinglycdn.com/files/b2f5a550-28a0-4866-86f2-e3827121641c/zigejanigibirulofula.pdf
    • https://uploads.strikinglycdn.com/files/9056635b-16d1-4e2d-a8f0-55d5e2059c97/22227806379.pdf
    • https://uploads.strikinglycdn.com/files/9faae174-1ee1-42b9-8e7d-00ec9f040469/gowojiratebuteforuka.pdf
    • http://bekujosekufeto.epizy.com/aleks_math_problem_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010445.bin
ff6ca99fda5f75c8f0e956c77d0c03b19d3a85f1b88f2440fe73d1d99533d8dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10445 5768 bytes
font_01_sfnt_off000117de.bin
7979a04986a3aa772792ae1810abd7e72d94b11981639c8ab72a7cbf1abf69bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117DE 11372 bytes
font_02_sfnt_off00013e94.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E94 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.